swiftstatuscheck[.]sc-sec[.]online

This domain, swiftstatuscheck.sc-sec.online, is identified as an active crypto drainer phishing endpoint designed to harvest wallet credentials and siphon digital assets. Analysis indicates the site employs fraudulent transaction status pages mimicking legitimate blockchain explorers, tricking users into entering private keys or signing malicious payloads. No direct brand impersonation is observed, but the infrastructure aligns with known drainer kits used in recent campaigns targeting decentralized finance platforms. Infrastructure analysis reveals the domain was registered on July 03, 2024, through DYNADOT LLC, a registrar frequently associated with phishing operations. It resolves to the IP address 163.61.188.9, which has been linked to multiple malicious domains in the past 30 days. VirusTotal detection metrics show 6 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing currently lists it as unsafe. Additional blocklist aggregators report the domain on 4 active threat feeds, including those specializing in financial fraud and cryptocurrency-related threats. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. As of the latest verification, swiftstatuscheck.sc-sec.online remains operational, with no evidence of takedown or registrar intervention. Users are advised to block the domain at the network level and invalidate any credentials exposed to the site. Wallet holders should revoke permissions for any suspicious smart contracts and monitor transaction histories for unauthorized activity. Given the domain's persistence and targeted nature, organizations should update endpoint protection rules to include the IP 163.61.188.9 and associated indicators in threat intelligence feeds.